System Security Plan
<Information System Name>, <Date>
FedRAMP System Security Plan Abbreviated
Template for 3PAO Application
<Vendor Name>
<Information System Name>
<Version 1.0>
November 29, 2013
Company Sensitive and Proprietary
For Authorized Use Only
System Security Plan
<Information System Name>, <Date>
System Security Plan
Prepared by
Identification of Organization that Prepared this Document
Organization Name
Street Address
<insert logo>
Suite/Room/Building
City, State Zip
Prepared for
Identification of Cloud Service Provider
Organization Name
Street Address
<insert logo>
Suite/Room/Building
City, State Zip
Company Sensitive and Proprietary
Page 2
System Security Plan
<Information System Name>, <Date>
Executive Summary
This document details the System Security Plan (SSP) for the <Information System
Name> security controls. This System Security Plan was written in accordance with
National Institute of Standards and Technology (NIST) Special Publication (SP) 800-18,
Revision 1, Guide for Developing Security Plans for Information Technology Systems.
<Company Name> is a <privately/publicly> owned company headquartered in <City,
State>. Completion of this SSP, which describes how U.S. federal information will be
safeguarded, is a requirement of the Office of Management and Budget (OMB) Circular
A-130, Management of Federal Information Resources, Appendix III, Security of Federal
Automated Information Resources, and Public Law 100-235, the Computer Security Act
of 1987.
Company Sensitive and Proprietary
Page 3
System Security Plan
<Information System Name>, <Date>
Document Revision History
Date
Description
Version
of
System
Author
05/17/2012
Initial Publication
N/A
FedRAMP Office
06/06/2012
Changed Numbering in Instruction Statement §9.3.
N/A
FedRAMP Office
06/13/2012
Formatting AC-17(7).
N/A
FedRAMP Office
06/18/2012
Updated RA-5a.
N/A
FedRAMP Office
06/18/2012
Added RA-5(5).
N/A
FedRAMP Office
7/23/2012
Table of Contents Updated; Added Instruction to
§9.3; Revised Signature Pages; Revised Tables 6-1
and 6-2; Updated Instruction for §7.0; Updated
Instruction for §9.4.
N/A
FedRAMP Office
07/25/2012
Removed CP-9d.
N/A
FedRAMP Office
10/15/2012
Revised formatting for CM-3(g); Added two rows (h
and i) to IA-5 table on p. 185.
N/A
FedRAMP Office
12/5/2012
Part c removed from CM-2(5). Revised AC-16 to
include missing text.
N/A
FedRAMP Office
1/21/2013
Added guidance for SC-12(5); Added requirement
for RA-5a; Removed rows for AU-12d, IA-2(1), PS-4,
PS-8, SA-10; Typo CM-6, IA-2(3), AC-11 ; Added rows
for PE-16, AU-7, AC-14; Formatting IR-4, IA-3, PS-3;
Updated Instructions for CM-8; Updated Note in
10.1.1; Headings SI-4, CM-2, CM-4, SC-15.
N/A
FedRAMP Office
Company Sensitive and Proprietary
Page 4
Table of Contents
About This Document ................................................................................................................................. 10
Who should use this document? ................................................................................................................ 10
How this document is organized ................................................................................................................. 10
Conventions Used In This Document .......................................................................................................... 11
How to contact us ....................................................................................................................................... 11
System Security Plan Approvals .................................................................................................................. 13
1.
Information System Name/Title ...................................................................................................... 14
2.
Information System Categorization................................................................................................. 14
2.1.
Information Types ........................................................................................................... 14
2.2.
Security Objectives Categorization (FIPS 199) ................................................................ 16
2.3.
E-Authentication Determination (E-Auth) ...................................................................... 17
3.
Information System Owner ............................................................................................................. 18
4.
Authorizing Official.......................................................................................................................... 18
5.
Other Designated Contacts ............................................................................................................. 18
6.
Assignment of Security Responsibility ............................................................................................ 19
7.
Information System Operational Status .......................................................................................... 20
8.
Information System Type ................................................................................................................ 20
9.
10.
11.
8.1.
Cloud Service Model ....................................................................................................... 20
8.2.
Leveraged Provisional Authorizations ............................................................................. 21
General System Description ............................................................................................................ 21
9.1.
System Function or Purpose ........................................................................................... 22
9.2.
Information System Components and Boundaries ......................................................... 22
9.3.
Types of Users ................................................................................................................. 22
9.4.
Network Architecture...................................................................................................... 23
System Environment ....................................................................................................................... 23
10.1.
Hardware Inventory ........................................................................................................ 24
10.2.
Software Inventory.......................................................................................................... 24
10.3.
Network Inventory .......................................................................................................... 25
10.4.
Data Flow ........................................................................................................................ 27
10.5.
Ports, Protocols and Services .......................................................................................... 27
System Interconnections ................................................................................................................. 28
Company Sensitive and Proprietary
Page 5
<Information System Name> System Security Plan
Version <0.00> / <Date>
12.
13.
Applicable Laws and Regulations .................................................................................................... 30
12.1.
Applicable Laws ............................................................................................................... 30
12.2.
Applicable Standards and Guidance ............................................................................... 30
Minimum Security Controls ............................................................................................................ 31
Access Control (AC) ..................................................................................................................................... 35
13.1.
Account Management (AC-2) .......................................................................................... 35
13.1.1.1.
Control Enhancements for Account Management ......................................................... 37
13.1.1.1.1. Control Enhancement AC-2 (1) ................................................................................... 37
13.1.1.1.2. Control Enhancement AC-2 (2) ................................................................................... 38
13.1.1.1.3. Control Enhancement AC-2 (3) ................................................................................... 39
13.1.1.1.4. Control Enhancement AC-2 (4) ................................................................................... 39
13.1.1.1.5. Control Enhancement AC-2 (7) ................................................................................... 40
13.2.
Information Flow Enforcement (AC-4) ............................................................................ 41
13.3.
Remote Access (AC-17) ................................................................................................... 42
13.3.1.1.
Control Enhancements for Remote Control .................................................................... 43
13.3.1.1.1. Control Enhancement AC-17 (1) ................................................................................. 43
13.3.1.1.2. Control Enhancement AC-17 (2) ................................................................................. 44
13.3.1.1.3. Control Enhancement AC-17 (3) ................................................................................. 45
13.3.1.1.4. Control Enhancement AC-17 (4) ................................................................................. 46
Awareness and Training (AT) ....................................................................................................................... 46
13.4.
Security Training (AT-3) ................................................................................................... 46
Audit and Accountability (AU)..................................................................................................................... 47
13.5.
Auditable Events (AU-2) .................................................................................................. 47
13.5.1.1.
Control Enhancements for Auditable Events .................................................................. 49
13.5.1.1.1. Control Enhancement AU-2 (3) ................................................................................... 49
13.6.
Response to Audit Processing Failures (AU-5) ................................................................ 50
13.7.
Protection of Audit Information (AU-9) .......................................................................... 51
13.8.
Audit Generation (AU-12) ............................................................................................... 52
Configuration Management (CM) ............................................................................................................... 53
13.9.
Security Impact Analysis (CM-4) ..................................................................................... 53
13.10.
Configuration Settings (CM-6)......................................................................................... 54
13.10.1.1. Control Enhancements for Configuration Settings.......................................................... 56
13.10.1.1.1. Control Enhancement CM-6 (1) .................................................................................. 56
Contingency Planning (CP) .......................................................................................................................... 57
Company Sensitive and Proprietary
Page 6
<Information System Name> System Security Plan
Version <0.00> / <Date>
13.11.
Information System Backup (CP-9).................................................................................. 57
13.11.1.1. Control Enhancements for Information System Backup ................................................. 58
13.11.1.1.1. Control Enhancement CP-9 (1).................................................................................... 59
13.11.1.1.2. Control Enhancement CP-9 (3).................................................................................... 59
Identification and Authentication (IA) ........................................................................................................ 60
13.12.
Cryptographic Module Authentication (IA-7) ................................................................. 60
Incident Response (IR) ................................................................................................................................ 61
13.13.
Incident Handling (IR-4) .................................................................................................. 61
13.13.1.1. Control Enhancement for Incident Handling .................................................................. 62
13.13.1.1.1. Control Enhancement IR-4 (1)..................................................................................... 62
13.14.
Incident Monitoring (IR-5)............................................................................................... 63
System and Services Acquisition (SA) ......................................................................................................... 64
13.15.
Life Cycle Support (SA-3) ................................................................................................. 64
Risk Assessment (RA) .................................................................................................................................. 65
13.16.
Vulnerability Scanning (RA-5) .......................................................................................... 65
13.16.1.1. Control Enhancements for Vulnerability Scanning ......................................................... 67
13.16.1.1.1. Control Enhancement RA-5 (1) ................................................................................... 67
13.16.1.1.2. Control Enhancement RA-5 (2) ................................................................................... 68
13.16.1.1.3. Control Enhancement RA-5 (3) ................................................................................... 69
13.16.1.1.4. Control Enhancement RA-5 (5) ................................................................................... 69
13.16.1.1.5. Control Enhancement RA-5 (6) ................................................................................... 70
System and Communications Protection (SC) ............................................................................................. 71
13.17.
Application Partitioning (SC-2) ........................................................................................ 71
13.18.
Information In Shared Resources (SC-4) ......................................................................... 72
System and Information Integrity (SI) ......................................................................................................... 72
13.19.
Flaw Remediation (SI-2) .................................................................................................. 73
13.20.
Information In Shared Resources (SC-4) ......................................................................... 74
13.20.1.1. Control Enhancement for Flaw Remediation .................................................................. 74
13.20.1.1.1. Control Enhancement SI-2 (2) ..................................................................................... 75
13.21.
Information System Monitoring (SI-4) ............................................................................ 75
Acronyms .................................................................................................................................................... 78
Company Sensitive and Proprietary
Page 7
<Information System Name> System Security Plan
Version <0.00> / <Date>
Company Sensitive and Proprietary
Page 8
<Information System Name> System Security Plan
Version <0.00> / <Date>
List of Tables
Table 1-1. Information System Name and Title ........................................................................................... 14
Table 2-1. Security Categorization............................................................................................................... 14
Table 2-2. Sensitivity Categorization of Information Types ......................................................................... 16
Table 2-3. Security Impact Level ................................................................................................................. 16
Table 2-4. Baseline Security Categorization ................................................................................................ 17
Table 2-5. E-Authentication Questions ....................................................................................................... 17
Table 2-6. E-Authentication Level Determination ....................................................................................... 17
Table 3-1. Information System Owner ........................................................................................................ 18
Table 5-1. Information System Management Point of Contact ................................................................... 18
Table 5-2. Information System Technical Point of Contact.......................................................................... 19
Table 6-1. CSP Internal ISSO (or Equivalent) ............................................................................................... 19
Table 6-2. FedRAMP Appointed ISSO .......................................................................................................... 19
Table 7-1. System Status ............................................................................................................................. 20
Table 8-1. Service Layers Represented in this SSP ...................................................................................... 20
Table 8-2. Leveraged Authorizations ........................................................................................................... 21
Table 9-1. User Roles and Privileges............................................................................................................ 22
Table 10-1. Server Hardware Components ................................................................................................. 24
Table 10-2. Software Components .............................................................................................................. 25
Table 10-3. Network Components .............................................................................................................. 25
Table 10-4. Ports, Protocols, and Services .................................................................................................. 27
Table 11-1. System Interconnections .......................................................................................................... 28
Table 13-1. Summary of Required Security Controls .................................................................................. 32
Table 13-2. Authorized Connections .............................................................. Error! Bookmark not defined.
List of Figures
Figure 10-1. Network Diagram .................................................................................................................... 23
Figure 10-2. Data Flow Diagram .................................................................................................................. 27
Company Sensitive and Proprietary
Page 9
<Information System Name> System Security Plan
Version <0.00> / <Date>
ABOUT THIS DOCUMENT
This document is released in template format. Once populated with content, this document will
include detailed information about service provider information security controls.
WHO SHOULD USE THIS DOCUMENT?
This document is intended to be used by service providers who are applying for a Provisional
Authorization through the U.S. federal government FedRAMP program. U.S. federal agencies
may want to use it to document information systems security plans that are not part of the
FedRAMP program.
Other uses of this template include using it to document organizational information security
controls for the purpose of creating a plan to manage a large information security infrastructure.
Complex and sophisticated systems are difficult to manage without a documented understanding
of how the infrastructure is architected.
HOW THIS DOCUMENT IS ORGANIZED
This document is divided into six sections and includes <number> attachments. Most sections
include subsections.
Section 1 identifies the system.
Section 2 describes the system categorization in accordance with FIPS 199.
Section 3 identifies the system owner and provides contact information.
Section 4 identifies the authorizing official.
Section 5 identifies other designated contacts.
Section 6 identifies the assignment of security responsibility.
Section 7 identifies the operational status of the information system.
Section 8 identifies the type of information system.
Section 9 describes the function and purpose of the information system.
Section 10 describes the information system environment.
Section 11 identifies interconnections between other information systems.
Section 12 describes laws and regulations related to operations of the information system.
Company Sensitive and Proprietary
Page 10
<Information System Name> System Security Plan
Version <0.00> / <Date>
Section 13 provides an in-depth description of how each security control is implemented.
CONVENTIONS USED IN THIS DOCUMENT
This document uses the following typographical conventions:
Italic
Italics are used for email addresses, security control assignments parameters, and formal
document names.
Italic blue in a box
Italic blue text in a blue box indicates instructions to the individual filling out the template.
Instruction: This is an instruction to the individual filling out of the template.
Bold
Bold text indicates a parameter or an additional requirement.
Constant width
Constant width text is used for text that is representative of characters that would show up on
a computer screen.
<Brackets>
Blue bold text in brackets indicates a user defined variable that should be replaced with a
specific name. Once the text has been replaced, the brackets should be removed.
Notes
Notes are found between parallel lines and include additional information that may be helpful
to the users of this template.
Note: This is a note.
Sans Serif
Sans Serif text is used for tables, table captions, figure captions, and table of contents.
Sans Serif Gray
Sans Serif gray text is used for examples.
HOW TO CONTACT US
If you have questions about FedRAMP, or if you have technical questions about this document
Company Sensitive and Proprietary
Page 11
<Information System Name> System Security Plan
Version <0.00> / <Date>
including how to use it, write to:
info@fedramp.gov
For more information about the FedRAMP project, please see the website at:
http://www.fedramp.gov.
Company Sensitive and Proprietary
Page 12
<Information System Name> System Security Plan
Version <0.00> / <Date>
SYSTEM SECURITY PLAN APPROVALS
Cloud Service Provider Signatures
x
<Name>
<Title>
<Cloud Service Provider>
<Date>
x
<Name>
<Title>
<Cloud Service Provider>
<Date>
x
<Name>
<Title>
<Cloud Service Provider>
Company Sensitive and Proprietary
<Date>
Page 13
<Information System Name> System Security Plan
Version <0.00> / <Date>
1. INFORMATION SYSTEM NAME/TITLE
This System Security Plan provides an overview of the security requirements for the
<Information System Name> (<Information System Abbreviation>) and describes the
controls in place or planned for implementation to provide a level of security appropriate for the
information to be transmitted, processed or stored by the system. Information security is an asset
vital to our critical infrastructure and its effective performance and protection is a key component
of our national security program. Proper management of information technology systems is
essential to ensure the confidentiality, integrity and availability of the data transmitted, processed
or stored by the <Information System Name> information system.
The security safeguards implemented for the <Information System Name> system meet the
policy and control requirements set forth in this System Security Plan. All systems are subject to
monitoring consistent with applicable laws, regulations, agency policies, procedures and
practices.
Table 1-1. Information System Name and Title
Unique Identifier
Information System Name
Information System Abbreviation
2. INFORMATION SYSTEM CATEGORIZATION
The overall information system sensitivity categorization is noted in the table that follows.
Table 2-1. Security Categorization
Low
Moderate
High
2.1. Information Types
This section describes how the information types used by the information system are categorized
for confidentiality, integrity, and availability sensitivity levels.
The following tables identify the information types that are input, stored, processed, and/or
output from <Information System Name>. The selection of the information types is based on
guidance provided by OMB Federal Enterprise Architecture Program Management Office
Business Reference Model 2.0, and FIPS Pub 199, Standards for Security Categorization of
Federal Information and Information Systems which is based on NIST SP 800-60, Guide for
Mapping Types of Information and Information Systems to Security Categories.
Company Sensitive and Proprietary
Page 14
<Information System Name> System Security Plan
Version <0.00> / <Date>
The tables also identify the security impact levels for confidentiality, integrity, and availability
for each of the information types expressed as low, moderate, or high. The security impact levels
are based on the potential impact definitions for each of the security objectives (i.e.,
confidentiality, integrity, and availability) discussed in NIST SP 800-60 and FIPS Pub 199.
The potential impact is low if—
- The loss of confidentiality, integrity, or availability could be expected to have a limited
adverse effect on organizational operations, organizational assets, or individuals.
- A limited adverse effect means that, for example, the loss of confidentiality, integrity, or
availability might: (i) cause a degradation in mission capability to an extent and duration
that the organization is able to perform its primary functions, but the effectiveness of the
functions is noticeably reduced; (ii) result in minor damage to organizational assets; (iii)
result in minor financial loss; or (iv) result in minor harm to individuals.
The potential impact is moderate if—
- The loss of confidentiality, integrity, or availability could be expected to have a serious
adverse effect on organizational operations, organizational assets, or individuals.
- A serious adverse effect means that, for example, the loss of confidentiality, integrity, or
availability might: (i) cause a significant degradation in mission capability to an extent
and duration that the organization is able to perform its primary functions, but the
effectiveness of the functions is significantly reduced; (ii) result in significant damage to
organizational assets; (iii) result in significant financial loss; or (iv) result in significant
harm to individuals that does not involve loss of life or serious life threatening injuries.
The potential impact is high if—
- The loss of confidentiality, integrity, or availability could be expected to have a severe
or catastrophic adverse effect on organizational operations, organizational assets, or
individuals.
- A severe or catastrophic adverse effect means that, for example, the loss of
confidentiality, integrity, or availability might: (i) cause a severe degradation in or loss of
mission capability to an extent and duration that the organization is not able to perform
one or more of its primary functions; (ii) result in major damage to organizational assets;
(iii) result in major financial loss; or (iv) result in severe or catastrophic harm to
individuals involving loss of life or serious life threatening injuries.
Company Sensitive and Proprietary
Page 15
<Information System Name> System Security Plan
Version <0.00> / <Date>
Instruction: Record your information types in the table that follow. Record the sensitivity level
for Confidentiality, Integrity, and Availability as High, Moderate, or Low. Add more rows as
needed to add more information types. Use NIST SP 800-60 Guide for Mapping Types of
Information and Systems to Security Categories, Volumes I & II, Revision 1 for guidance.
Note: The information types found in NIST SP 800-60, Volumes I and II
Revision 1 are the same information types found in the Federal Enterprise
Architecture (FEA) Consolidated Reference Model.
Table 2-2. Sensitivity Categorization of Information Types
Information Type
Confidentiality
Integrity
Availability
2.2. Security Objectives Categorization (FIPS 199)
Based on the information provided in Table 2-2, Information Types, for the <Information
System Name> default to the high-water mark for the noted Information Types as identified in
the table below.
Table 2-3. Security Impact Level
Security Objective
Low, Moderate or High
Confidentiality
Integrity
Availability
Note: Please refer to FIPS PUB 199 Standards for Security Categorization
of Federal Information and Information Systems.
Through review and analysis it has been determined that the baseline security categorization for
the <Information System Name> system is listed in the table that follows.
Company Sensitive and Proprietary
Page 16
<Information System Name> System Security Plan
Version <0.00> / <Date>
Table 2-4. Baseline Security Categorization
<Information System Name> Security Categorization
Low, Moderate or High
Using this categorization, in conjunction with the risk assessment and any unique security
requirements, we have established the security controls for this system, as detailed in this SSP.
2.3. E-Authentication Determination (E-Auth)
The information system e-Authentication Determination is described in the table that follows.
Table 2-5. E-Authentication Questions
Yes
No
E-Authentication Question
Does the system require authentication via the Internet?
Is data being transmitted over the Internet via browsers?
Do users connect to the system from over the Internet?
Instruction: Any information system that has a “No” response to any one of the three questions
does not need an E-Authentication risk analysis or assessment. For a system that has a "Yes"
response to all of the questions, complete the E-Authentication Plan (a template is available).
Note: Please refer to OMB Memo M-04-04 E-Authentication Guidance for
Federal Agencies for more information on e-Authentication.
The summary E-Authentication Level is recorded in the table that follows.
Table 2-6. E-Authentication Level Determination
E-Authentication Determination
System Name
System Owner
Assurance Level
Date Approved
Company Sensitive and Proprietary
Page 17
<Information System Name> System Security Plan
Version <0.00> / <Date>
3. INFORMATION SYSTEM OWNER
The following individual is identified as the system owner or functional proponent/advocate for
this system.
Table 3-1. Information System Owner
Name
Title
Company / Organization
Address
Phone Number
Email Address
4. AUTHORIZING OFFICIAL
The Authorizing Official (AO) or Designated Approving Authority (DAA) for this information
system is the Federal Risk Authorization Management Program (FedRAMP), Joint Authorization
Board (JAB) as comprised of member representatives from the General Services Administration
(GSA), Department of Defense (DOD) and Department of Homeland Security (DHS).
5. OTHER DESIGNATED CONTACTS
The following individual(s) identified below possess in-depth knowledge of this system and/or
its functions and operation.
Table 5-1. Information System Management Point of Contact
Name
Title
Company / Organization
Address
Phone Number
Company Sensitive and Proprietary
Page 18
<Information System Name> System Security Plan
Version <0.00> / <Date>
Email Address
Table 5-2. Information System Technical Point of Contact
Name
Title
Company / Organization
Address
Phone Number
Email Address
Instruction: Add more tables as needed.
6. ASSIGNMENT OF SECURITY RESPONSIBILITY
The Information System Security Officers (ISSO), or their equivalent, identified below, have
been appointed in writing and are deemed to have significant cyber and operational role
responsibilities.
Table 6-1. CSP Internal ISSO (or Equivalent)
Name
Title
Company / Organization
Address
Phone Number
Email Address
Table 6-2. FedRAMP Appointed ISSO
Name
Title
FedRAMP ISSO
Company Sensitive and Proprietary
Page 19
<Information System Name> System Security Plan
Version <0.00> / <Date>
FedRAMP
Address
1275 First Street, NE, Washington, DC, 20002, Room 1180
Phone Number
Email Address
7. INFORMATION SYSTEM OPERATIONAL STATUS
The system is currently in the life-cycle phase noted in the table that follows.
Table 7-1. System Status
System Status
Operational
The system is operating and in production.
Under Development
The system is being designed, developed, or implemented
Major Modification
The system is undergoing a major change, development, or transition.
Other
Explain:
Instruction: Select as many status indicators that apply. If more than one status is selected, list
which components of the system are covered under each status indicator.
8. INFORMATION SYSTEM TYPE
The <Information System Name> makes use of unique managed service provider architecture
layer(s).
8.1. Cloud Service Model
Information systems, particularly those based on cloud architecture models, are made up of
different service layers. The layers of the <Information System Name> that are defined in this
SSP, and are not leveraged by any other Provisional Authorizations, are indicated in the table that
follows.
Instruction: Check all layers that apply.
Table 8-1. Service Layers Represented in this SSP
Service Provider Architecture Layers
Company Sensitive and Proprietary
Page 20
<Information System Name> System Security Plan
Version <0.00> / <Date>
Service Provider Architecture Layers
Software as a Service (SaaS)
Major Application
Platform as a Service (PaaS)
Major Application
Infrastructure as a Service (IaaS)
General Support System
Other
Explain:
Note: Please refer to NIST SP 800-145 for information on cloud computing
architecture models.
8.2. Leveraged Provisional Authorizations
Instruction: The FedRAMP program qualifies different service layers for Provisional
Authorizations. One, or multiple service layers, can be qualified in one System Security Plan.
See the section on Use Cases in Guide to Understanding FedRAMP for more information.
If a lower level layer has been granted a Provisional Authorization, and another higher level
layer represented by this SSP plans to leverage a lower layer’s Provisional Authorization, this
System Security Plan must clearly state that intention. If an information system does not
leverage any pre-existing Provisional Authorizations, write “None” in the first column of the
table that follows. Add as many rows as necessary in the table that follows.
The <Information System Name> <plans to/does not plan to> leverage a pre-existing
Provisional Authorization. Provisional Authorizations leveraged by this <Information System
Name> are noted in the table that follows.
Table 8-2. Leveraged Authorizations
Information System Name
Service Provider Owner
Date Granted
9. GENERAL SYSTEM DESCRIPTION
This section includes a general description of the <Information System Name>.
Company Sensitive and Proprietary
Page 21
<Information System Name> System Security Plan
Version <0.00> / <Date>
9.1. System Function or Purpose
Instruction: In the space that follows, describe the purpose and functions of this system.
9.2. Information System Components and Boundaries
Instruction: In the space that follows, describe the information system’s major components,
inter-connections, and boundaries in sufficient detail that accurately depicts the authorization
boundary for the information system. Formal names of components as they are known at the
service provider organization in functional specs, configuration guides, other documents, and
live configurations should be named here and described. Please ensure that the discussion on
boundaries is consistent with the network diagram shown in Section 9.4. Please see Guide to
Understanding FedRAMP for more information.
9.3. Types of Users
All users have their employee status categorized with a sensitivity level in accordance with PS-2.
Employees (or contractors) of service providers are considered Internal Users. All other users are
considered External Users. User privileges (authorization permission after authentication takes
place) are described in the table that follows.
Instruction: For an External User, please write “Not Applicable” in the Sensitivity Level
Column. Please include systems administrators and database administrators as a role types.
(Also include web server administrators, network administrators, and firewall administrators if
these individuals have the ability to configure a device or host that could impact the CSP
service offering.) Add additional rows if necessary.
Table 9-1. User Roles and Privileges
Role
Internal or External
Sensitivity Level
Company Sensitive and Proprietary
Authorized Privileges and
Functions Performed
Page 22
<Information System Name> System Security Plan
Version <0.00> / <Date>
Role
Internal or External
Sensitivity Level
Authorized Privileges and
Functions Performed
Note: User roles typically align with Active Directory, LDAP, Role-based
Access Controls (RBAC), NIS and UNIX groups, and/or UNIX
netgroups.
There are currently <number> of internal users and <number> of external users. Within one
year, it is anticipated that there will be <number> of internal users and <number> of external
users.
9.4. Network Architecture
Instruction: Insert a network architectural diagram in the space that follows. Ensure that the
following items are labeled on the diagram: hostnames, DNS servers, authentication and access
control servers, directory servers, firewalls, routers, switches, database servers, major
applications, Internet connectivity providers, telecom circuit numbers, and network
numbers/VLANs. If necessary, include multiple network diagrams.
The following architectural diagram(s) provides a visual depiction of the major hardware
components that constitute <Information System Name>.
<insert diagram>
Figure 10-1. Network Diagram
10. SYSTEM ENVIRONMENT
Instruction: In the space that follows, provide a general description of the technical system
environment. Include information about all system environments that are used, e.g. production
environment, test environment, staging or QA environments.
Company Sensitive and Proprietary
Page 23
<Information System Name> System Security Plan
Version <0.00> / <Date>
10.1. Hardware Inventory
The following table lists the principal server hardware components for <Information System
Name>.
Instruction: Please include server hardware and any major storage components in this table.
The first three rows are sample entries. If your service offering does not include hardware
because you are leveraging all hardware from a pre-existing Provisional Authorization, write
“None” in the first column. Add additional rows as needed.
Table 10-1. Server Hardware Components
Hostname
Make
Model and
Firmware
Location
Components that Use this
Device
hostname1.com
Company
SilverEdge M710,
4.6ios
Dallas, Rm. 6, Rack 4
AppOne, EAuthApp
hostname2.com
Company
SilverEdge M610,
4.6ios
Datacenter2, Rack 7
VMs 1-50
Not Applicable
Company
iSCSI SAN Storage
Bldg 4, Rm 7
SAN Storage
Note: A complete and detailed list of the system hardware and software
inventory is required per NIST SP 800-53, Rev 3 CM-8.
10.2. Software Inventory
The following table lists the principle software components for <Information System Name>.
Instruction: Please include any middleware, databases, or secure file transfer applications in
this table. The first three rows are sample entries. The first three rows are sample entries. Add
additional rows as needed.
Company Sensitive and Proprietary
Page 24
<Information System Name> System Security Plan
Version <0.00> / <Date>
Table 10-2. Software Components
Hostname
Function
Version
Patch Level
Virtual
(Yes / No)
hostname1.com
Physical Host for Virtual
Infrastructure
XYZi.4.x vSphere
Update 1
No
SP2
Yes
SP1
Yes
hostname2.com
Virtual Machine Application Server Windows 2003 Server
hostname3.com
Virtual Database SQL Server
6.4.22 build 7
10.3. Network Inventory
The following table lists the principle network devices and components for <Information
System Name>.
Instruction: Please include any switches, routers, hubs, and firewalls that play a role in
protecting the information system, or that enable the network to function properly. The first
three rows are sample entries. If all network devices and components are leveraged from a preexisting Provisional Authorization, write “Leveraged” in the first column. Add additional rows
as needed.
Table 10-3. Network Components
Hostname
Make
Model
IP Address
Function
router-dallas
RouterCo
2800
192.168.0.1
router
switch-1
SwitchCo
EZSX55W
10.5.3.1
switch
fw.yourcompany.com
FirewallCo
21400, R71.x
192.168.0.2
firewall
Company Sensitive and Proprietary
Page 25
<Information System Name> System Security Plan
Version <0.00> / <Date>
Hostname
Make
Model
Company Sensitive and Proprietary
IP Address
Function
Page 26
10.4. Data Flow
Instruction: In the space that follows, describe the flow of data in and out of system boundaries and insert a data flow diagram.
See Guide to Understanding FedRAMP for a dataflow example. If necessary, include multiple data flow diagrams.
<insert diagram>
Figure 10-2. Data Flow Diagram
10.5. Ports, Protocols and Services
The table below lists the Ports, Protocols, and Services enabled in this information system. TCP ports are indicated with a T and UDP
ports are indicated with a U.
Instruction: In the column labeled “Used By” please indicate the components of the information system that make use of the ports,
protocols, and services. In the column labeled “Purpose” indicate the purpose for the service (e.g. system logging, HTTP
redirector, load balancing). This table should be consistent with CM-6 and CM-7. You must fill out this table, even if you are
leveraging a pre-existing Provisional Authorization. Add more rows as needed.
Table 10-4. Ports, Protocols, and Services
Ports (T or U)
Protocols
Services
Company Sensitive and Proprietary
Purpose
Used By
Page 27
<Information System Name> System Security Plan
Version <0.00> / <Date>
Ports (T or U)
Protocols
Services
Purpose
Used By
11. SYSTEM INTERCONNECTIONS
Instruction: List all interconnected systems. Provide the IP address and interface identifier (ie0, ie1, ie2) for the CSP system that
provides the connection. Name the external organization and the IP address of the external system. Indicate how the connection is
being secured. For Connection Security indicate how the connection is being secured. For Data Direction, indicate which direction
the packets are flowing. For Information Being Transmitted, describe what type of data is being transmitted. If a dedicated telecom
line is used, indicate the circuit number. Add additional rows as needed. This table should be consistent with CA-3.
Table 11-1. System Interconnections
CSP IP Address
and Interface
External
Organization
Name and IP
Address of
System
External Point of
Contact and
Phone Number
Connection Security
(IPSec VPN, SSL,
Certificates, Secure
File Transfer etc.)
Data Direction
(incoming,
outgoing, or
both)
Information Being Transmitted
Company Sensitive and Proprietary
Ports or Circuit #
Page 28
<Information System Name> System Security Plan
Version <0.00> / <Date>
CSP IP Address
and Interface
External
Organization
Name and IP
Address of
System
External Point of
Contact and
Phone Number
Connection Security
(IPSec VPN, SSL,
Certificates, Secure
File Transfer etc.)
Data Direction
(incoming,
outgoing, or
both)
Information Being Transmitted
Company Sensitive and Proprietary
Ports or Circuit #
Page 29
12. APPLICABLE LAWS AND REGULATIONS
12.1. Applicable Laws
The following laws and regulations apply to the information system:














Computer Fraud and Abuse Act [PL 99-474, 18 USC 1030]
E-Authentication Guidance for Federal Agencies [OMB M-04-04]
Federal Information Security Management Act (FISMA) of 2002 [Title III, PL 107-347]
Freedom of Information Act As Amended in 2002 [PL 104-232, 5 USC 552]
Guidance on Inter-Agency Sharing of Personal Data – Protecting Personal Privacy [OMB
M-01-05]
Homeland Security Presidential Directive-7, Critical Infrastructure Identification,
Prioritization, and Protection [HSPD-7]
Internal Control Systems [OMB Circular A-123]
Management of Federal Information Resources [OMB Circular A-130]
Management’s Responsibility for Internal Control [OMB Circular A-123, Revised
12/21/2004]
Privacy Act of 1974 as amended [5 USC 552a]
Protection of Sensitive Agency Information [OMB M-06-16]
Records Management by Federal Agencies [44 USC 31]
Responsibilities for the Maintenance of Records About Individuals by Federal Agencies
[OMB Circular A-108, as amended]
Security of Federal Automated Information Systems [OMB Circular A-130, Appendix
III]
12.2. Applicable Standards and Guidance
The following standards and guidance apply to the information system:







A NIST Definition of Cloud Computing [NIST SP 800-145]
Computer Security Incident Handling Guide [NIST SP 800—61, Revision 1]
Contingency Planning Guide for Federal Information Systems [NIST SP 800-34,
Revision 1]
Engineering Principles for Information Technology Security (A Baseline for Achieving
Security) [NIST SP 800-27, Revision A]
Guide for Assessing the Security Controls in Federal Information Systems [NIST SP 80053A]
Guide for Developing Security Plans for Federal Information Systems [NIST SP 800-18,
Revision 1]
Guide for Developing the Risk Management Framework to Federal Information Systems:
A Security Life Cycle Approach [NIST SP 800-37, Revision 1]
Company Sensitive and Proprietary
Page 30
<Information System Name> System Security Plan
Version <0.00> / <Date>











Guide for Mapping Types of Information and Information Systems to Security Categories
[NISP SP 800-60, Revision 1]
Guide for Security-Focused Configuration Management of Information Systems [NIST
SP 800-128]
Information Security Continuous Monitoring for Federal Information Systems and
Organizations [NIST SP 800-137]
Minimum Security Requirements for Federal Information and Information Systems [FIPS
Publication 200]
Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS
Publication 201-1]
Recommended Security Controls for Federal Information Systems [NIST SP 800-53,
Revision 3]
Risk Management Guide for Information Technology Systems [NIST SP 800-30]
Security Considerations in the System Development Life Cycle [NIST SP 800-64,
Revision 2]
Security Requirements for Cryptographic Modules [FIPS Publication 140-2]
Standards for Security Categorization of Federal Information and Information Systems
[FIPS Publication 199]
Technical Guide to Information Security Testing and Assessment [NIST SP 800-115]
Note: All NIST Computer Security Publications can be found at the following
URL: http://csrc.nist.gov/publications/PubsSPs.html
13. MINIMUM SECURITY CONTROLS
Security controls must meet minimum security control baseline requirements. There are security
control baseline requirements for management controls, operational controls, and technical
controls.
Management security controls identify the management safeguards and countermeasures in-place
or planned for <Information System Name>. Management Controls are those safeguards and
countermeasures that focus on the management of risk and the management of the information
security system. They are actions that are performed primarily to support information system
security management decisions.
Operational security controls identify the operational safeguards and countermeasures in-place or
planned for <Information System Name>. Operational controls are those safeguards and
countermeasures that are primarily implemented and executed by people as opposed to systems
and technology.
Technical security controls identify the technical safeguards and countermeasures in-place or
planned for <Information System Name>. Technical Controls are those safeguards and
Company Sensitive and Proprietary
Page 31
<Information System Name> System Security Plan
Version <0.00> / <Date>
countermeasures that are primarily implemented and executed by the information system through
mechanisms contained in the hardware, software, or firmware components of the system.
Upon categorizing a system as Low, Moderate, or High sensitivity in accordance with FIPS 199,
the appropriate security control baseline standards are applied. Some of the control baselines
have enhanced controls which are indicated in parenthesis.
Security controls that are representative of the sensitivity of <Information System Name> are
described in the sections that follow. Security controls that are designated as “Not Selected” or
“Withdrawn by NIST” are not described unless they have additional FedRAMP controls.
Guidance on how to describe the implemented standard can be found in NIST 800-53, Rev 3.
Control enhancements are marked in parenthesis in the sensitivity columns.
Systems that are categorized as FIPS 199 Low use the controls designated as Low and systems
categorized as FIPS 199 Moderate use the controls designated as Moderate. A summary of which
security standards pertain to which sensitivity level is found in the table that follows. If a security
control has an additional requirement for FedRAMP that is above and beyond the NIST 800-53,
Rev 3 standard, the additional requirement is noted in the right-hand column.
Table 13-1. Summary of Required Security Controls
Sensitivity Level
ID
Control Description
Low
Mod
Delta from
NIST 800-53 r3
Access Control
AC-2
Account Management
AC-4
Information Flow Enforcement
AC-17
Remote Access
AC-2
AC-2, (1) (2) (3) (4)
(7)
Yes
Not Selected
AC-4
No
AC-17
AC-17 (1) (2) (3) (4)
Yes
AT-3
No
Awareness and Training
AT-3
Security Training
AT-3
Audit and Accountability
AU-2
Auditable Events
AU-2
AU-2 (3)
Yes
AU-5
Response to Audit Processing Failures
AU-5
AU-5
No
AU-9
Protection of Audit Information
AU-9
AU-9 (2)
Yes
AU-12
Audit Generation
AU-12
AU-12
No
Company Sensitive and Proprietary
Page 32
<Information System Name> System Security Plan
Version <0.00> / <Date>
Sensitivity Level
ID
Control Description
Low
Mod
Delta from
NIST 800-53 r3
Configuration Management
CM-4
Security Impact Analysis
CM-4
CM-4
No
CM-6
Configuration Settings
CM-6
CM-6 (1)
Yes
CP-9 (1) (3)
Yes
IA-7
No
Contingency Planning
CP-9
Information System Backup
CP-9
Identification and Authentication
IA-7
Cryptographic Module Authentication
IA-7
Incident Response
IR-4
Incident Handling
IR-4
IR-4 (1)
Yes
IR-5
Incident Monitoring
IR-5
IR-5
No
RA-5 (1) (2) (3) (5)
(6)
Yes
SA-3
No
Risk Assessment
RA-5
Vulnerability Scanning
RA-5
System and Services Acquisition
SA-3
Life Cycle Support
SA-3
System and Services Acquisition
SC-2
Application Partitioning
Not Selected
SC-2
No
SC-4
Information in Shared Resources
Not Selected
SC-4
No
SI-2 (2)
No
System and Information Integrity
SI-2
Flaw Remediation
SI-2
Company Sensitive and Proprietary
Page 33
<Information System Name> System Security Plan
Version <0.00> / <Date>
Instruction: In the sections that follow, please describe the information security control as it is
implemented on your system. All controls originate from a system or from a business process. It is
important to describe where the control originates from so that it is clear whose responsibility it
is to implement, manage, and monitor the control. In some cases, the responsibility is shared by a
CSP and by the customer. Use the definitions in the table that follows to indicate where each
security control originates from. Note that -1 Controls (AC-1, AU-1, SC-1 etc.) cannot be
inherited and must be provided in some way by the service provider.
Control Origination
Definition
Example
Service Provider
Corporate
A control that originates from the CSP
corporate network.
DNS from the corporate network provides
address resolution services for the
information system and the service
offering.
Service Provider System
Specific
A control specific to a particular system
at the CSP and the control is not part of
the standard corporate controls.
A unique host based intrusion detection
system (HIDs) is available on the service
offering platform but is not available on
the corporate network.
Service Provider Hybrid
A control that makes use of both
corporate controls and additional
controls specific to a particular system
at the CSP.
There a scans of the corporate network
infrastructure; scans of databases and web
based application are system specific.
Configured by Customer
A control where the customer needs to
apply a configuration in order to meet
the control requirement.
User profiles, policy/audit configurations,
enabling/disabling key switches (e.g.,
enable/disable http or https, etc.), entering
an IP range specific to their organization
are configurable by the customer.
Provided by Customer
A control where the customer needs to
provide additional hardware or
software in order to meet the control
requirement.
The customer provides a SAML SSO
solution to implement two-factor
authentication.
Shared
A control that is managed and
implemented partially by the CSP and
partially by the customer.
Security awareness training must be
conducted by both the CSP and the
customer.
Inherited from preexisting Provisional
Authorization
A control that is inherited from
another CSP system that has already
received a Provisional Authorization.
A PaaS or SaaS provider inherits PE
controls from an IaaS provider.
Company Sensitive and Proprietary
Page 34
<Information System Name> System Security Plan
Version <0.00> / <Date>
ACCESS CONTROL (AC)
13.1. Account Management (AC-2)
The organization manages information system accounts, including:
(a) Identifying account types (i.e., individual, group, system, application,
guest/anonymous, and temporary);
(b) Establishing conditions for group membership;
(c) Identifying authorized users of the information system and specifying access
privileges;
(d) Requiring appropriate approvals for requests to establish accounts;
(e) Establishing, activating, modifying, disabling, and removing accounts;
(f) Specifically authorizing and monitoring the use of guest/anonymous and temporary
accounts;
(g) Notifying account managers when temporary accounts are no longer required and
when information system users are terminated, transferred, or information system
usage or need-to-know/need-to-share changes;
(h) Deactivating: (i) temporary accounts that are no longer required; and (ii) accounts of
terminated or transferred users;
(i) Granting access to the system based on: (i) a valid access authorization; (ii) intended
system usage; and (iii) other attributes as required by the organization or associated
missions/business functions; and
(j) Reviewing accounts [Assignment: organization-defined frequency].
AC-2j Parameter Requirement: [at least annually]
AC-2
Control Summary Information
Responsible Role:
Parameter AC-2j:
Implementation Status (check all that apply):
Implemented
Company Sensitive and Proprietary
Page 35
<Information System Name> System Security Plan
Version <0.00> / <Date>
AC-2
Control Summary Information
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AC-2 What is the solution and how is it implemented?
Part a
Part b
Part c
Part d
Part e
Part f
Company Sensitive and Proprietary
Page 36
<Information System Name> System Security Plan
Version <0.00> / <Date>
AC-2 What is the solution and how is it implemented?
Part g
Part h
Part i
Part j
13.1.1.1.
Control Enhancements for Account Management
13.1.1.1.1.
Control Enhancement AC-2 (1)
AC-2 (1) The organization employs automated mechanisms to support the management of
information system accounts.
AC-2 (1) Control Enhancement Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
Company Sensitive and Proprietary
Page 37
<Information System Name> System Security Plan
Version <0.00> / <Date>
AC-2 (1) What is the solution and how is it implemented?
13.1.1.1.2.
Control Enhancement AC-2 (2)
AC-2 (2) The information system automatically terminates temporary and emergency accounts
after [Assignment: organization-defined time period for each type of account (temporary and
emergency)].
AC-2 (2) Parameter Requirement: [no more than ninety days for temporary and
emergency account types]
AC-2 (2)
Control Enhancement Summary Information
Responsible Role:
Parameter:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AC-2 (2) What is the solution and how is it implemented?
Company Sensitive and Proprietary
Page 38
<Information System Name> System Security Plan
Version <0.00> / <Date>
13.1.1.1.3.
Control Enhancement AC-2 (3)
AC-2 (3) The information system automatically disables inactive accounts after [Assignment:
organization-defined time period].
AC-2 (3) Parameter Requirement: [ninety days for user accounts]. See additional
requirements and guidance.
AC-2 (3) Additional FedRAMP Requirements and Guidance: Requirement: The
service provider defines the time period for non-user accounts (e.g., accounts associated
with devices). The time periods are approved and accepted by the JAB.
AC-2 (3)
Control Enhancement Summary Information
Responsible Role:
Parameter:
Parameter Additional:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Configured by customer
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid(Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AC-2 (3) What is the solution and how is it implemented?
13.1.1.1.4.
Control Enhancement AC-2 (4)
AC-2 (4) The information system automatically audits account creation, modification, disabling,
and termination actions and notifies, as required, appropriate individuals.
Company Sensitive and Proprietary
Page 39
<Information System Name> System Security Plan
Version <0.00> / <Date>
AC-2 (4)
Control Enhancement Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AC-2 (4) What is the solutions and how is it implemented?
13.1.1.1.5.
Control Enhancement AC-2 (7)
AC-2 (7) The organization:
(a) Establishes and administers privileged user accounts in accordance with a role-based
access scheme that organizes information system and network privileges into roles;
and
(b) Tracks and monitors privileged role assignments.
AC-2 (7)
Control Enhancement Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Company Sensitive and Proprietary
Page 40
<Information System Name> System Security Plan
Version <0.00> / <Date>
AC-2 (7)
Control Enhancement Summary Information
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AC-2 (7) What is the solution and how is it implemented?
Part a
Part b
13.2. Information Flow Enforcement (AC-4)
The information system enforces approved authorizations for controlling the flow of
information within the system and between interconnected systems in accordance with
applicable policy.
AC-4
Control Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Company Sensitive and Proprietary
Page 41
<Information System Name> System Security Plan
Version <0.00> / <Date>
AC-4
Control Summary Information
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AC-4 What is the solution and how is it implemented?
13.3. Remote Access (AC-17)
The organization:
(a) Documents allowed methods of remote access to the information system;
(b) Establishes usage restrictions and implementation guidance for each allowed remote
access method;
(c) Monitors for unauthorized remote access to the information system;
(d) Authorizes remote access to the information system prior to connection; and
(e) Enforces requirements for remote connections to the information system.
AC-17
Control Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Company Sensitive and Proprietary
Page 42
<Information System Name> System Security Plan
Version <0.00> / <Date>
AC-17
Control Summary Information
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AC-17 What is the solution and how is it implemented?
Part a
Part b
Part c
Part d
Part e
13.3.1.1.
Control Enhancements for Remote Control
13.3.1.1.1.
Control Enhancement AC-17 (1)
AC-17 (1) The organization employs automated mechanisms to facilitate the monitoring and
control of remote access methods.
AC-17 (1)
Control Enhancement Summary Information
Responsible Role:
Implementation Status (check all that apply):
Company Sensitive and Proprietary
Page 43
<Information System Name> System Security Plan
Version <0.00> / <Date>
AC-17 (1)
Control Enhancement Summary Information
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AC-17 (1) What is the solution and how is it implemented?
13.3.1.1.2.
Control Enhancement AC-17 (2)
AC-17 (2) The organization uses cryptography to protect the confidentiality and integrity of
remote access sessions.
AC-17 (2)
Control Enhancement Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Company Sensitive and Proprietary
Page 44
<Information System Name> System Security Plan
Version <0.00> / <Date>
AC-17 (2)
Control Enhancement Summary Information
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AC-17 (2) What is the solution and how is it implemented?
13.3.1.1.3.
Control Enhancement AC-17 (3)
AC-17 (3) The information system routes all remote accesses through a limited number of
managed access control points.
AC-17 (3)
Control Enhancement Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AC-17 (3) What is the solution and how is it implemented?
Company Sensitive and Proprietary
Page 45
<Information System Name> System Security Plan
Version <0.00> / <Date>
13.3.1.1.4.
Control Enhancement AC-17 (4)
AC-17 (4) The organization authorizes the execution of privileged commands and access to
security-relevant information via remote access only for compelling operational needs and
documents the rationale for such access in the security plan for the information system.
AC-17 (4)
Control Enhancement Summary Information
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AC-17 (4) What is the solution and how is it implemented?
AWARENESS AND TRAINING (AT)
13.4. Security Training (AT-3)
The organization provides role-based security-related training:
(a) Before authorizing access to the system or performing assigned duties;
(b) When required by system changes; and [Assignment: organization-defined frequency]
thereafter.
AT-3 Parameter Requirement: [at least every three years]
Company Sensitive and Proprietary
Page 46
<Information System Name> System Security Plan
Version <0.00> / <Date>
AT-3
Control Summary Information
Responsible Role:
Parameter:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AT-3 What is the solution and how is it implemented?
Part a
Part b
AUDIT AND ACCOUNTABILITY (AU)
13.5. Auditable Events (AU-2)
The organization:
(a) Determines, based on a risk assessment and mission/business needs, that the information
system must be capable of auditing the following events [Assignment: organizationdefined list of auditable events];
Company Sensitive and Proprietary
Page 47
<Information System Name> System Security Plan
Version <0.00> / <Date>
AU-2a Parameter Requirement: [Successful and unsuccessful account logon events,
account management events, object access, policy change, privilege functions, process
tracking, and system events. For Web applications: all administrator activity,
authentication checks, authorization checks, data deletions, data access, data changes, and
permission changes]
(b) Coordinates the security audit function with other organizational entities requiring audit
related information to enhance mutual support and to help guide the selection of auditable
events;
(c) Provides a rationale for why the list of auditable events are deemed to be adequate to
support after-the-fact investigations of security incidents; and
(d) Determines, based on current threat information and ongoing assessment of risk, that the
following events are to be audited [Assignment: organization-defined subset of the
auditable events defined in AU-2 a. to be audited] within the information system
[Assignment: organization-defined frequency of (or situation requiring) auditing for each
identified event].
AU-2d Parameter Requirement: [continually]
AU-2d Additional FedRAMP Parameter Requirement: Requirement: The
service provider defines the subset of auditable events from AU-2a to be audited.
The events to be audited are approved and accepted by JAB.
AU-2
Control Summary Information
Responsible Role:
AU-2a Parameter:
AU-2d Parameter:
AU-2d Additional FedRAMP Parameter:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Company Sensitive and Proprietary
Page 48
<Information System Name> System Security Plan
Version <0.00> / <Date>
AU-2
Control Summary Information
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AU-2 What is the solution and how is it implemented?
Part a
Part b
Part c
Part d
13.5.1.1.
Control Enhancements for Auditable Events
13.5.1.1.1.
Control Enhancement AU-2 (3)
AU-2 (3) The organization reviews and updates the list of auditable events [Assignment:
organization-defined frequency]
AU-2 (3) Parameter Requirement: [annually or whenever there is a change in the threat
environment]
AU-2 (3) Additional FedRAMP Requirements and Guidance: Guidance: Annually or
whenever changes in the threat environment are communicated to the service provider by
the JAB.
AU-2 (3)
Control Enhancement Summary Information
Responsible Role:
Parameter:
Company Sensitive and Proprietary
Page 49
<Information System Name> System Security Plan
Version <0.00> / <Date>
AU-2 (3)
Control Enhancement Summary Information
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AU-2 (3) What is the solution and how is it implemented?
13.6. Response to Audit Processing Failures (AU-5)
The information system:
(a) Alerts designated organizational officials in the event of an audit processing failure; and
(b) Takes the following additional actions: [Assignment: organization-defined actions to be
taken]
AU-5b Parameter Requirement: [low-impact: overwrite oldest audit records;
moderate-impact: shut down]
AU-5
Control Summary Information
Responsible Role:
Parameter:
Implementation Status (check all that apply):
Company Sensitive and Proprietary
Page 50
<Information System Name> System Security Plan
Version <0.00> / <Date>
AU-5
Control Summary Information
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AU-5 What is the solution and how is it implemented?
Part a
Part b
13.7. Protection of Audit Information (AU-9)
The information system protects audit information and audit tools from unauthorized access,
modification, and deletion.
AU-9
Control Summary Information
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Company Sensitive and Proprietary
Page 51
<Information System Name> System Security Plan
Version <0.00> / <Date>
AU-9
Control Summary Information
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AU-9 What is the solution and how is it implemented?
13.8. Audit Generation (AU-12)
The information system:
(a) Provides audit record generation capability for the list of auditable events defined in AU2 at [Assignment: organization-defined information system components];
AU-12a Parameter Requirements: [all information system components where audit
capability is deployed]
(b) Allows designated organizational personnel to select which auditable events are to be
audited by specific components of the system; and
(c) Generates audit records for the list of audited events defined in AU-2 with the content as
defined in AU-3.
AU-12
Control Summary Information
Responsible Role:
Parameter:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Company Sensitive and Proprietary
Page 52
<Information System Name> System Security Plan
Version <0.00> / <Date>
AU-12
Control Summary Information
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
AU-12 What is the solution and how is it implemented?
Part a
Part b
Part c
CONFIGURATION MANAGEMENT (CM)
13.9. Security Impact Analysis (CM-4)
The organization analyzes changes to the information system to determine potential security
impacts prior to change implementation.
CM-4
Control Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Company Sensitive and Proprietary
Page 53
<Information System Name> System Security Plan
Version <0.00> / <Date>
CM-4
Control Summary Information
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
CM-4 What is the solution and how is it implemented?
13.10.
Configuration Settings (CM-6)
The organization:
(a) Establishes and documents mandatory configuration settings for information technology
products employed within the information system using [Assignment: organizationdefined security configuration checklists] that reflect the most restrictive mode consistent
with the sensitivity level;
CM-6a Additional FedRAMP Requirements and Guidance: Requirement: Use
USGCB configuration checklists if available. If not available, the service provider
uses configuration settings based on industry best practices such as Center for
Internet Security guidelines. Otherwise, the service provider establishes their own
configuration settings. Indicate if checklists from outside organizations are used.
Indicate if checklists for configuration settings are Security Content Automation
Protocol (SCAP) validated or SCAP compatible (if validated checklists are not
available). Configuration settings are approved and accepted by the JAB.
(b) Implements the configuration settings;
Company Sensitive and Proprietary
Page 54
<Information System Name> System Security Plan
Version <0.00> / <Date>
(c) Identifies, documents, and approves exceptions from the mandatory configuration
settings for individual components within the information system based on explicit
operational requirements; and
(d) Monitors and controls changes to the configuration settings in accordance with
organizational policies and procedures.
Note: Information on the USGCB checklists can be found at:
http://usgcb.nist.gov/usgcb_faq.html#usgcbfaq_usgcbfdcc\
Information on SCAP can be found at:
http://scap.nist.gov/
CM-6
Control Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
CM-6 What is the solution and how is it implemented?
Part a
Company Sensitive and Proprietary
Page 55
<Information System Name> System Security Plan
Version <0.00> / <Date>
CM-6 What is the solution and how is it implemented?
Part b
Part c
Part d
13.10.1.1.
Control Enhancements for Configuration Settings
13.10.1.1.1. Control Enhancement CM-6 (1)
CM-6 (1) The organization employs automated mechanisms to centrally manage, apply, and
verify configuration settings.
CM-6 (1)
Control Enhancement Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
CM-6 (1) What is the solution and how is it implemented?
Company Sensitive and Proprietary
Page 56
<Information System Name> System Security Plan
Version <0.00> / <Date>
CM-6 (1) What is the solution and how is it implemented?
CONTINGENCY PLANNING (CP)
13.11.
Information System Backup (CP-9)
The organization:
(a) Conducts backups of user-level information contained in the information system at
least [Assignment: organization-defined frequency consistent with recovery time and
recovery point objectives]
CP-9a Parameter Requirement: [daily incremental; weekly full]
CP-9a Additional FedRAMP Requirements and Guidance: Requirement: The
service provider maintains at least three backup copies of user-level information
(at least one of which is available online) or provides an equivalent alternative.
The backup storage capability is approved and accepted by the JAB.
(b) Conducts backups of system-level information contained in the information system at
least [Assignment: organization-defined frequency consistent with recovery time and
recovery point objectives]
CP-9b Parameter Requirement: [daily incremental; weekly full]
CP-9b Additional FedRAMP Requirements and Guidance: Requirement: The
service provider maintains at least three backup copies of system-level
information (at least one of which is available online) or provides an equivalent
alternative. The backup storage capability is approved and accepted by the JAB.
(c) Conducts backups of information system documentation including security-related
documentation at least [Assignment: organization-defined frequency consistent with
recovery time and recovery point objectives]; and
CP-9c Parameter Requirement: [daily incremental; weekly full]
CP-9c Additional FedRAMP Requirements and Guidance: Requirement: The
service provider maintains at least three backup copies of information system
documentation including security information (at least one of which is available
Company Sensitive and Proprietary
Page 57
<Information System Name> System Security Plan
Version <0.00> / <Date>
online) or provides an equivalent alternative. The backup storage capability is
approved and accepted by the JAB
CP-9
Control Summary Information
Responsible Role:
Parameter 9a:
Parameter 9b:
Parameter 9c:
Implementation Type (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
CP-9 What is the solution and how is it implemented?
Part a
Part b
Part c
13.11.1.1.
Control Enhancements for Information System Backup
Company Sensitive and Proprietary
Page 58
<Information System Name> System Security Plan
Version <0.00> / <Date>
13.11.1.1.1. Control Enhancement CP-9 (1)
CP-9 (1) The organization tests backup information [Assignment: organization-defined
frequency] to verify media reliability and information integrity.
CP-9 (1) Parameter Requirement: [at least annually]
CP-9 (1)
Control Enhancement Summary Information
Responsible Role:
Parameter:
Implementation Type (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
CP-9 (1) What is the solution and how is it implemented?
13.11.1.1.2. Control Enhancement CP-9 (3)
CP-9 (3) The organization stores backup copies of the operating system and other critical
information system software, as well as copies of the information system inventory (including
hardware, software, and firmware components) in a separate facility or in a fire-rated container
that is not collocated with the operational system.
CP-9 (3)
Control Enhancement Summary Information
Responsible Role:
Implementation Type (check all that apply):
Company Sensitive and Proprietary
Page 59
<Information System Name> System Security Plan
Version <0.00> / <Date>
CP-9 (3)
Control Enhancement Summary Information
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
CP-9 (3) What is the solution and how is it implemented?
IDENTIFICATION AND AUTHENTICATION (IA)
13.12.
Cryptographic Module Authentication (IA-7)
The information system uses mechanisms for authentication to a cryptographic module that
meets the requirements of applicable federal laws, Executive Orders, directives, policies,
regulations, standards, and guidance for such authentication.
IA-7
Control Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Company Sensitive and Proprietary
Page 60
<Information System Name> System Security Plan
Version <0.00> / <Date>
IA-7
Control Summary Information
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
IA-7 What is the solution and how is it implemented?
INCIDENT RESPONSE (IR)
13.13.
Incident Handling (IR-4)
The organization:
(a) Implements an incident handling capability for security incidents that includes
preparation, detection and analysis, containment, eradication, and recovery;
(b) Coordinates incident handling activities with contingency planning activities; and
(c) Incorporates lessons learned from ongoing incident handling activities into incident
response procedures, training, and testing/exercises, and implements the resulting
changes accordingly.
Additional FedRAMP Requirements and Guidance: Requirement: The service provider
ensures that individuals conducting incident handling meet personnel security requirements
commensurate with the criticality/sensitivity of the information being processed, stored, and
transmitted by the information system.
Company Sensitive and Proprietary
Page 61
<Information System Name> System Security Plan
Version <0.00> / <Date>
IR-4
Control Summary Information
Responsible Role:
Implementation Type (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
IR-4 What is the solution and how is it implemented?
Part a
Part b
Part c
13.13.1.1.
Control Enhancement for Incident Handling
13.13.1.1.1. Control Enhancement IR-4 (1)
IR-4 (1) The organization employs automated mechanisms to support the incident handling
process.
IR-4 (1)
Control Enhancement Summary Information
Company Sensitive and Proprietary
Page 62
<Information System Name> System Security Plan
Version <0.00> / <Date>
IR-4 (1)
Control Enhancement Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
IR-4 (1) What is the solution and how is it implemented?
13.14.
Incident Monitoring (IR-5)
The organization tracks and documents information system security incidents.
IR-5
Control Enhancement Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Company Sensitive and Proprietary
Page 63
<Information System Name> System Security Plan
Version <0.00> / <Date>
IR-5
Control Enhancement Summary Information
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
IR-5 What is the solution and how is it implemented?
SYSTEM AND SERVICES ACQUISITION (SA)
13.15.
Life Cycle Support (SA-3)
The organization:
(a) Manages the information system using a system development life cycle methodology
that Includes information security considerations;
(b) Defines and documents information system security roles and responsibilities
throughout the system development life cycle; and
(c) Identifies individuals having information system security roles and responsibilities.
SA-3
Control Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Company Sensitive and Proprietary
Page 64
<Information System Name> System Security Plan
Version <0.00> / <Date>
SA-3
Control Summary Information
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
SA-3 What is the solution and how is it implemented?
Part a
Part b
Part c
RISK ASSESSMENT (RA)
13.16.
Vulnerability Scanning (RA-5)
The organization:
(a) Scans for vulnerabilities in the information system and hosted applications
[Assignment: organization-defined frequency and/or randomly in accordance with
organization-defined process] and when new vulnerabilities potentially affecting the
system/applications are identified and reported;
RA-5a Parameter Requirements: [monthly operating system/infrastructure;
quarterly web applications and databases]
RA-5a Additional FedRAMP Requirements and Guidance: Requirement: An
accredited independent assessor scans operating systems/infrastructure, web
applications, and databases once annually.
(b) Employs vulnerability scanning tools and techniques that promote interoperability
among tools and automate parts of the vulnerability management process by using
standards for:
Company Sensitive and Proprietary
Page 65
<Information System Name> System Security Plan
Version <0.00> / <Date>



Enumerating platforms, software flaws, and improper configurations;
Formatting and making transparent, checklists and test procedures; and
Measuring vulnerability impact;
(c) Analyzes vulnerability scan reports and results from security control assessments;
(d) Remediates legitimate vulnerabilities; [Assignment: organization-defined response
times], in accordance with an organizational assessment of risk; and
RA-5d Parameter Requirements: [high-risk vulnerabilities mitigated within
thirty days; moderate risk vulnerabilities mitigated within ninety days]
(e) Shares information obtained from the vulnerability scanning process and security
control assessments with designated personnel throughout the organization to help
eliminate similar vulnerabilities in other information systems (i.e., systemic
weaknesses or deficiencies).
RA-5
Control Summary Information
Responsible Role:
Parameter 5a:
Parameter 5d:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
RA-5 What is the solution and how is it implemented?
Company Sensitive and Proprietary
Page 66
<Information System Name> System Security Plan
Version <0.00> / <Date>
RA-5 What is the solution and how is it implemented?
Part a
Part b
Part c
Part d
Part e
13.16.1.1.
Control Enhancements for Vulnerability Scanning
13.16.1.1.1. Control Enhancement RA-5 (1)
RA-5 (1) The organization employs vulnerability scanning tools that include the capability to
readily update the list of information system vulnerabilities scanned.
RA-5 (1)
Control Enhancement Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Company Sensitive and Proprietary
Page 67
<Information System Name> System Security Plan
Version <0.00> / <Date>
RA-5 (1)
Control Enhancement Summary Information
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
RA-5 (1) What is the solution and how is it implemented?
13.16.1.1.2. Control Enhancement RA-5 (2)
RA-5 (2) The organization updates the list of information system vulnerabilities scanned
[Assignment: organization-defined frequency] or when new vulnerabilities are identified and
reported.
RA-5(2) Parameter Requirements: [continuously, before each scan]
RA-5 (2)
Control Enhancement Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
RA-5 (2) What is the solution and how is it implemented?
Company Sensitive and Proprietary
Page 68
<Information System Name> System Security Plan
Version <0.00> / <Date>
RA-5 (2) What is the solution and how is it implemented?
13.16.1.1.3. Control Enhancement RA-5 (3)
RA-5 (3) The organization employs vulnerability scanning procedures that can demonstrate the
breadth and depth of coverage (i.e., information system components scanned and vulnerabilities
checked).
RA-5 (3)
Control Enhancement Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
RA-5 (3) What is the solution and how is it implemented?
13.16.1.1.4. Control Enhancement RA-5 (5)
RA-5(5) The organization includes privileged access authorization to [Assignment: organizationidentified information system components] for selected vulnerability scanning activities to
facilitate more thorough scanning.
RA-5(5) Parameter Requirements: operating systems/infrastructure, databases, web
applications.
Company Sensitive and Proprietary
Page 69
<Information System Name> System Security Plan
Version <0.00> / <Date>
RA-5 (5)
Control Enhancement Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
RA-5 (5) What is the solution and how is it implemented?
13.16.1.1.5. Control Enhancement RA-5 (6)
RA-5 (6) The organization employs automated mechanisms to compare the results of
vulnerability scans over time to determine trends in information system vulnerabilities.
RA-5 (6)
Control Enhancement Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Company Sensitive and Proprietary
Page 70
<Information System Name> System Security Plan
Version <0.00> / <Date>
RA-5 (6)
Control Enhancement Summary Information
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
RA-5 (6) What is the solution and how is it implemented?
SYSTEM AND COMMUNICATIONS PROTECTION (SC)
13.17.
Application Partitioning (SC-2)
The information system separates user functionality (including user interface services) from
information system management functionality.
SC-2
Control Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
SC-2 What is the solution and how is it implemented?
Company Sensitive and Proprietary
Page 71
<Information System Name> System Security Plan
Version <0.00> / <Date>
SC-2 What is the solution and how is it implemented?
13.18.
Information In Shared Resources (SC-4)
The information system prevents unauthorized and unintended information transfer via shared
system resources.
SC-4
Control Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
SC-4 What is the solution and how is it implemented?
SYSTEM AND INFORMATION INTEGRITY (SI)
Company Sensitive and Proprietary
Page 72
<Information System Name> System Security Plan
Version <0.00> / <Date>
13.19.
Flaw Remediation (SI-2)
The organization:
(a) Identifies, reports, and corrects information system flaws;
(b) Tests software updates related to flaw remediation for effectiveness and potential side
effects on organizational information systems before installation; and
(c) Incorporates flaw remediation into the organizational configuration management
process.
SI-2
Control Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
SI-2 What is the solution and how is it implemented?
Part a
Part b
Company Sensitive and Proprietary
Page 73
<Information System Name> System Security Plan
Version <0.00> / <Date>
SI-2 What is the solution and how is it implemented?
Part c
13.20.
Information In Shared Resources (SC-4)
The information system prevents unauthorized and unintended information transfer via shared
system resources.
SC-4
Control Summary Information
Responsible Role:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
SC-4 What is the solution and how is it implemented?
13.20.1.1.
Control Enhancement for Flaw Remediation
Company Sensitive and Proprietary
Page 74
<Information System Name> System Security Plan
Version <0.00> / <Date>
13.20.1.1.1. Control Enhancement SI-2 (2)
SI-2 (2) The organization employs automated mechanisms [Assignment: organization-defined
frequency] to determine the state of information system components with regard to flaw
remediation.
SI-2 (2) Parameter Requirements: [at least monthly]
SI-2 (2)
Control Enhancement Summary Information
Responsible Role:
Parameter:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
SI-2 (2) What is the solution and how is it implemented?
13.21.
Information System Monitoring (SI-4)
The organization:
(a) Monitors events on the information system in accordance with [Assignment:
organization-defined monitoring objectives] and detects information system attacks;
SI-4a Parameter Requirements: [ensure the proper functioning of internal
processes and controls in furtherance of regulatory and compliance
Company Sensitive and Proprietary
Page 75
<Information System Name> System Security Plan
Version <0.00> / <Date>
requirements; examine system records to confirm that the system is
functioning in an optimal, resilient, and secure state; identify irregularities or
anomalies that are indicators of a system malfunction or compromise]
(b) Identifies unauthorized use of the information system;
(c) Deploys monitoring devices:
 strategically within the information system to collect organization-determined
essential information; and
 at ad hoc locations within the system to track specific types of transactions of
interest to the organization;
(d) Heightens the level of information system monitoring activity whenever there is an
indication of increased risk to organizational operations and assets, individuals, other
organizations, or the Nation based on law enforcement information, intelligence
information, or other credible sources of information; and
(e) Obtains legal opinion with regard to information system monitoring activities in
accordance with applicable federal laws, Executive Orders, directives, policies, or
regulations.
SI-4
Control Summary Information
Responsible Role:
Parameter:
Implementation Status (check all that apply):
Implemented
Partially implemented
Planned
Alternative implementation
Not applicable
Control Origination (check all that apply):
Service Provider Corporate
Service Provider System Specific
Service Provider Hybrid (Corporate and System Specific)
Configured by Customer (Customer System Specific)
Provided by Customer (Customer System Specific)
Shared (Service Provider and Customer Responsibility)
Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
SI-4 What is the solution and how is it implemented?
Company Sensitive and Proprietary
Page 76
<Information System Name> System Security Plan
Version <0.00> / <Date>
SI-4 What is the solution and how is it implemented?
Part a
Part b
Part c
Part d
Part e
Company Sensitive and Proprietary
Page 77
<Information System Name> System Security Plan
Version <0.00> / <Date>
Acronyms
Acronym
Definition
3PAO
Third Party Assessment Organization
ATO
Authority To Operate
CONOPS
Concept Of Operations
CSP
Cloud Service Provider
DHS
Department of Homeland Security
FedRAMP
Federal Risk and Authorization Management Program
FIPS
Federal Information Processing Standard
GSA
General Services Administration
ISSO
Information System Security Officer
JAB
Joint Authorization Board
NIST
National Institute of Standards and Technology
OMB
Office of Management and Budget
PII
Personally Identifiable Information
PMO
Program Management Office
POA&M
Plan Of Action & Milestones
SAP
Security Assessment Plan
SLA
Service Level Agreement
SOC
Security Operations Center
SSP
System Security Plan
US-CERT
U.S. Computer Emergency Response Team
Company Sensitive and Proprietary
Page 78